The costs associated with sending and receiving electronic messages, such as email messages, have reduced significantly to a point where the marginal cost of sending or receiving such a message is nearly zero. Commercial and other entities are thus able to send millions of email messages without incurring significant costs. However, the increased reliance on email has exposed the individuals and corporations that use email to threats from, for example, email viruses, spam, phishing attacks, and the like. Commercially available anti-virus software packages are typically employed to combat such attacks.
Anti-virus software typically employ filtration techniques to protect computers against viruses, worms, Trojan horses, and other unwanted messages. Filtration techniques classify an incoming message based on one or more rules that are applied to various attributes of the message. By way of example, a rule may indicate that an incoming message that contains a specific sender's electronic mail address is to be classified and treated as spam. End users, such as a recipient of messages, may also create and use rules to classify incoming messages to identify and handle spam appropriately. As an example, a user of an electronic mail client program may set up an “inbox rule” to move all incoming messages with a subject heading including the text “$$$” to a “deleted items” folder. One problem with filtration techniques is that commercial senders of messages (e.g., “spammers”) can adapt their messages to known or commonly employed filters to ensure that messages are not classified as spam. As a result, the filtration techniques react to existing or known attacks, and the filtration techniques may require a tremendous amount of manual intervention to keep up with the adaptations of the spammers. Any kind of manual intervention to react to an attack may be too late as a very large number of unwanted messages may have been processed as a result of the attack, causing additional burden on various resources—e.g., CPU, storage, network bandwidth, etc.